System and method for identifying computer network devices using inventory rules

Abstract

The present invention relates to a method for identifying a computer network device using inventory rules, which includes intercepting data traffic across one or more communication links of a computer network. The intercepted data traffic is analyzed to determine whether the intercepted data traffic satisfies one or more inventory rules of a plurality of inventory rules. Each of the plurality of inventory rules includes one or more conditions indicating the presence of a specific computer network device having a set of parameters. The computer network device is identified using the one or more satisfied inventory rules.

Description

Technical Field

[0001] The present disclosure relates to the field of computer networking, and more particularly to systems and methods for identifying computer network devices using inventory rules. Background Art

[0002] In today's world, computer devices such as desktop and portable personal computers, as well as smart phones, tablet computers and other mobile devices are used on a large scale, and various types of computer threats have become increasingly common. Examples of computer threats include network worms, Trojan horse programs, keyboard logging programs, ransomware, computer viruses and computer attacks. Computer attacks can be further classified into targeted attacks (also known as target attacks-TA) and complex attacks (advanced persistent threats-APT) against cyber physical systems (Cyber ​​Physical System-CPS) and information systems. Information systems are a collection of computing devices and communication devices for their interconnection, also known as enterprise infrastructure. Hackers may have a variety of goals, from simply stealing employees' personal data to industrial espionage. Hackers often obtain information about enterprise network architecture, internal file flow principles, means for protecting networks and computer devices, or any other information dedicated to information systems. This type of information allows hackers to bypass existing defenses, which often lack sufficient flexibility to meet all the needs of information systems.

[0003] Modern computer networks (especially CPS networks) typically include multiple devices, namely controllers, sensors, actuators, and other network nodes. Many devices may use outdated software that contains known vulnerabilities. Given the existence of a variety of complex and at least partially outdated technical devices, the process of updating software for such devices requires a lot of time and resources. At least in some cases, it may not even be possible to update such outdated software due to the manufacturer's discontinuation of support. Therefore, in order to ensure the security of CPS networks, it may be necessary to create an inventory of network devices in order to search for and eliminate vulnerabilities in computer devices at a higher level, such as at the gateway level. The term "device inventory" or "inventory" used in this article refers to the identification of devices connected to the network and the properties / parameters of these devices (including but not limited to the version of the operating system, firmware, software, etc.). In addition, the device inventory provides network administrators with complete and accurate data about the devices and network services being used on the network, with the aim of ensuring network security.

[0004] There are at least two known methods of generating computer network inventories in the prior art. The first method is called network scanning, which involves active network interaction with network objects. However, this method involves the risk of interrupting the running process of the device (such as a CPS controller-PLC). In this example, the PLC may receive information about the state of the controlled object from the control device and sensor. In response to receiving this information, the PLC can act on the actuator. The PLC is not programmed to interact with other network objects. Therefore, after receiving an inventory request from the system, the PLC's execution of instructions may be interrupted, and operator intervention may be required to restart the PLC or update its firmware. The second method is called passive analysis of network traffic to collect information about CPS devices, which solves the risks inherent in active (network scanning) analysis. However, this method also has several disadvantages, such as a low level of determination of CPS network device attributes.

[0005] In view of the above, there is a need to more efficiently identify computer network devices and / or identify and determine device attributes / parameters. Summary of the invention

[0006] Aspects of the present disclosure relate to the field of computer networks.

[0007] Aspects of the present disclosure are designed to use inventory rules to identify network devices and identify / determine parameters associated with the identified network devices.

[0008] The technical effect of the present disclosure is to more effectively identify network devices.

[0009] In one exemplary aspect, a method for identifying a computer network device using inventory rules includes intercepting data traffic across one or more communication links of a computer network. The intercepted data traffic is analyzed to determine whether the intercepted data traffic satisfies one or more inventory rules of a plurality of inventory rules. Each of the plurality of inventory rules includes one or more conditions indicating the presence of a particular computer network device having a set of parameters. The computer network device is identified using the one or more satisfied inventory rules.

[0010] In one aspect, each of the plurality of inventory rules has a weighting factor value indicating a priority for applying the corresponding rule. The weighting factor value is dependent on previously identified devices.

[0011] In an aspect, analyzing the plurality of inventory rules to determine whether one or more of the plurality of inventory rules are satisfied further includes searching at least one of the header portion and the payload portion of the plurality of data packets for a value that matches a corresponding parameter value contained in the plurality of inventory rules.

[0012] In one aspect, the set of parameters includes at least one of the following: a device identifier, a device name, a device model, a device type, a device security status, a device manufacturer, a protocol, one or more characteristics of an operating system installed on the corresponding device, and one or more characteristics of a software program installed on the corresponding device.

[0013] In one aspect, the plurality of inventory rules include at least: i) a vendor rule that lists one or more network addresses associated with each of a plurality of devices; ii) an asset rule that is configured to search for a digital signature that identifies one or more devices and one or more parameters associated therewith; iii) a protocol rule that is configured to search for a digital signature to identify one or more network protocols being used by the intercepted data traffic; and iv) a fingerprint rule that is configured to determine one or more device parameters using a digital fingerprint.

[0014] In one aspect, if a device parameter has been identified by at least two different inventory rules, the inventory rule having the largest weighting factor value is selected for device identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more implementation aspects of the present disclosure. The accompanying drawings, combined with the following detailed description, explain the principles and implementations of these example aspects.

[0016] Figure 1a Examples of technical systems in which aspects of the invention may be implemented are schematically shown.

[0017] Figure 1b Specific examples of technical systems that can implement various aspects of the present invention are schematically shown.

[0018] Figure 2 A diagram illustrating a system for identifying computer network devices using inventory rules according to aspects of the present disclosure.

[0019] Figure 3 A flow chart illustrating a method for identifying computer network devices using inventory rules according to aspects of the present disclosure is shown.

[0020] Figure 4 An example of a general-purpose computer system is shown. DETAILED DESCRIPTION

[0021] Various exemplary aspects are described herein in the context of systems, methods, and computer program products for identifying computer network devices using inventory rules. It should be appreciated by those skilled in the art that the following is illustrative only and is not intended to be limiting. In light of this disclosure, other aspects will be readily apparent to those skilled in the art. Specific implementations of various example aspects are now described in detail with reference to the accompanying drawings. Throughout the drawings and the following, the same reference numerals are used as much as possible to refer to the same or similar items.

[0022] A number of definitions and concepts used in describing various aspects of the present disclosure will now be introduced.

[0023] The term "Indicators of Compromise (IOC)", also known as "Indicators of Infection", refers to artifacts or residual characteristics of an intrusion into an information system that can be observed on a computer or network. Typical indicators of compromise may include triggered anti-virus records, unknown Internet Protocol (IP) addresses, checksums of suspicious files, Uniform Resource Locators (URLs) of suspicious websites, domain names of botnet command centers, etc. There are many standards for indicators of compromise, including but not limited to:

[0024] OpenIOC(https: / / www.fireeye.com / blog / threat-research / 2013 / 09 / history-openioc.html), STIX(https: / / stix.mitre.org / ), CybOX(https: / / cybox.mitre.org), etc.

[0025] The term "incident in the information system security system" (hereinafter referred to as event) refers to the detected system status, service or network status indicating a possible violation of information system security policy, violation of monitoring means and measures or their failure or previously unknown information system security-related situation.

[0026] The term "information security incident" (hereinafter referred to as incident) refers to one or more undesirable or unexpected events that may jeopardize business operations and threaten the security of information systems.

[0027] The term "controlled object" refers to a technological object that is subject to external action (control and / or disturbance) in order to change the state of this technological object. On the one hand, such controlled objects can include equipment (such as electric motors) or technological processes (or parts thereof).

[0028] The term "Technical Process (TP)" refers to a material production process consisting of sequential state changes of material entities (work objects).

[0029] The term "technical process control (process control)" refers to a set of methods used to control process variables during the production of the final product.

[0030] The term "control loop" refers to the physical entities and control functions required to automatically adjust the measured value of a process variable to a nominal setpoint. A control loop may include detectors, sensors, controllers, and actuators.

[0031] The term "process variable PV" refers to the present metered value of a particular portion of the TP being observed or monitored. A process variable may be, for example, a measurement from a sensor.

[0032] The term "setpoint" refers to the value of a process variable that should be maintained.

[0033] The term "manipulated variable (MV)" refers to the parameter that is adjusted to maintain the value of a process variable at a setpoint level.

[0034] The term "external action" refers to a method of changing the state of an element, such as an element of a technical system (TS), that is subject to an action in a specific direction, the action being transmitted in the form of a signal from one element of the TS to another element of the TS.

[0035] The term "state of a control object" refers to the sum of its basic properties, represented by state parameters that change or remain under the influence of external actions (including control actions from control subsystems).

[0036] The term "state parameter" refers to one or more values ​​that characterize an essential property of an object. In one aspect, a state parameter is a value of a physical quantity.

[0037] The term "formal state of a control object" refers to the state of a control object corresponding to a flow chart and other technical documents (in terms of TP) or a business schedule (in terms of equipment).

[0038] The term "control action" refers to an intentional (the goal of the action is to act on the state of the object) and legal (provided by TP) external action by the control subject of the control subsystem on a part of the control object, resulting in changing the state of the control object or saving the state of the control object.

[0039] The term "disturbance action" refers to an intentional or unintentional and illegal (not provided by TP) external action acting on the state of the control object, including actions acting on part of the control object.

[0040] The term "control subject" refers to a device that applies a control action to a control object or transfers a control action to another control object for transformation before applying the control action directly to the control object.

[0041] The term "multi-level control subsystem" refers to a collection of control entities involving multiple levels.

[0042] The term "cyber-physical systems (CPS)" refers to the concept of information systems that integrate computing resources into physical processes. In such systems, sensors, devices, and information systems are connected along the entire value creation chain, beyond the boundaries of a single enterprise or business. These systems can interact with each other via standard Internet protocols to predict, self-tune, and adapt to changes. Examples of CPS are technical systems, the Internet of Things (including wearable devices), and the Industrial Internet of Things.

[0043] The term "Internet of Things (IoT)" refers to a network of computers that are equipped with built-in technology for interacting with each other or with the outside world. The IoT includes technologies such as wearable devices, electronic systems in transportation, smart cars, smart cities, industrial systems, and more.

[0044] The term "Industrial Internet of Things (IIoT)" refers to devices connected to the Internet and extended analytical platforms that perform processing on data obtained from the connected devices. IIoT devices can be very diverse - from small weather sensors to complex industrial robots.

[0045] The term "technical system (TS)" refers to a set of control subjects and control objects (TP or equipment) of multi-level control subsystems that are functionally interconnected. In a technical system, the state change of the control object is achieved by the state change of the control subject. The structure of a technical system is formed by the basic elements of the technical system (the control subjects and control objects of the interconnected multi-level control subsystems) and the communication links between these elements. If the control object in the technical system is a technical process, the purpose of control is to change the state of the work object (raw material, processed blank, etc.) by causing the state change of the control object. If the control object in the technical system is equipment, the purpose of control may be to change the state of the equipment (vehicle, spacecraft, etc.). The functional relationship of TS elements often refers to the relationship between the states of these elements. There may not even be a direct physical link between the elements. For example, there may be no physical link between an actuator and a technical operation. However, for example, the cutting speed of a spindle may be functionally related to the rotation speed of the spindle even if these state parameters are not physically connected.

[0046] The term "control subject state" refers to the sum of the basic properties of the control subject, the state parameters that can be changed or maintained under the influence of external actions.

[0047] The term "basic attributes of the control subject" (and correspondingly basic parameters of the state) refers to attributes that directly affect the basic attributes of the state of the control object. The basic attributes of the control object can be attributes that directly affect the functional factors (precision, safety, efficacy) for TS control. Examples of basic attributes can include, but are not limited to: cutting conditions corresponding to form specified conditions, train movements corresponding to train routes, and processes to keep reactor temperature within an allowable range. Depending on the factors being controlled, the state parameters of the control object can be selected, and the state-related parameters of the control subject that apply control actions to the control object can be selected accordingly.

[0048] The term "state of technical system elements" refers to the state of control subjects and objects.

[0049] The term "real state of a technical system element" refers to the state of an element of a technical system acting on a control object at a certain time, which is determined by measuring state parameters and intercepting signals (traffic) between TS elements. For example, the measurement of state parameters can be performed using sensors installed in the TS.

[0050] The term “real state of a technical system” refers to the sum of the real states of the interrelated technical system elements.

[0051] The term "cybernetic block" refers to a cyberphysical monitoring system element that monitors the operating processes of a technical system element.

[0052] The term "state space" refers to a method of formalizing the state changes of a dynamic system (technical system or cyberphysical system).

[0053] The term "computer attack" (hereinafter referred to as cyber attack) refers to targeted actions acting on information systems and computer telecommunications networks through hardware and software, with the aim of undermining the information security in these systems and networks.

[0054] The term "targeted attack" (hereinafter also referred to as targeted attack - TA) refers to a special case of a computer attack directed against a specific organization or a specific individual.

[0055] The term "SIEM (Security Information and Event Management) system" refers to a means to control the information security of an organization as a whole and manage events received from various sources. SIEM systems can analyze events from network devices and various applications in real time.

[0056] Figure 1aAn example of a technical system (TS) is schematically shown, the technical system comprising: a control subject 110a; a control subject 110b that can be configured to form a multi-level control subsystem 120; a horizontal communication link 130a and a vertical communication link 130b. The control subjects 110b can be grouped in a hierarchy 140.

[0057] Figure 1b A specific example of an implementation of a technical system 100' is schematically shown. The control subject 110a' can be a TP or a device. On the one hand, the control action can be dispatched to the control subject 110a' by an automatic control system (ACS) 120'. The ACS 120' can have three levels 140', which are composed of horizontal levels through horizontal communication links (links within the same level, Figure 1b The control entities 110b' are interconnected at the horizontal level (not shown) and at the vertical level through vertical communication links 130b' (links between different levels of the ACS system). The relationship between the control entities 110b' can be a functional relationship. In other words, in general, a state change of a control entity 110b' at one level can cause a state change of a control entity 110b' connected thereto at the same level and / or at any other level. Information about the state change of the control entity 110b' can be transmitted in the form of a signal along the horizontal communication link and / or the vertical communication link 130b' established between the control entities 110b'. In other words, information about the state change of a specific control entity 110b' is an external action on other control entities 110b'. The level 140' within the ACS 120' can be identified according to the purpose of the control entity 110b'. The number of levels may vary, depending on the complexity of the automatic control system 120'. A simple technical system may contain one or more subordinate levels. On the one hand, wired networks, wireless networks and micro-integrated circuits can be used for the physical connection between the elements of TS (110a', 110b') and the subsystems of TS100. On the other hand, Ethernet, Industrial Ethernet or any of various industrial networks can be used for the logical link between the elements of TS (110a', 110b') and the subsystems of TS100. Industrial networks and protocols use various types and standards such as Profibus, FIP, ControlNet, Interbus-S, DeviceNet, P-NET, WorldFIP, LongWork, Modbus, etc.

[0058] The top level (SCADA) can be the dispatcher / operator control level, which includes at least the following control entities 110b': controller, control computer human-machine interface (HMI) ( Figure 1b). This level may be intended to track the status of elements of the TS (110a', 110b'), acquire and accumulate information about the status of elements of the TS (110a', 110b'), and make corrections when necessary.

[0059] The middle level (CONTROL level) can be a controller level, which includes at least the following control subjects: programmable logic controller (PLC), counter, relay, regulator. The control subject 110b' of type "PLC" can receive information about the state of the control subject 110a' from the control subject 110b' of type "measurement and control device" and the control subject 110b' of type "sensor". The control subject of type "PLC" can formulate (create) a control action according to the programmed control algorithm for the control subject of type "actuator". The actuator can directly execute the action at the lower level (specifically apply it to the control object). On the one hand, the actuator can be part of the execution device (equipment). Regulators such as PID regulators (proportional integral derivative controllers or PID controllers) can be devices in feedback control loops.

[0060] The lower level (input level / output level) can be a hierarchy of such control subjects, such as: sensors and measuring devices that monitor the state of the control subject 110a' and actuators. The actuator can directly act on the state of the control subject 110a' to make it conform to the formal state, that is, the state corresponding to the technology transfer, technical diagram or other technical documents (in terms of TP) or the business schedule (in terms of equipment). At this level, it may happen that the signals from the "sensor" type control subject 110b' are coordinated with the input of the intermediate control subject, and the control actions performed by the "PLC" type control subject 110b' are coordinated with the "actuator" type control subject 110b' that implements these actions. As mentioned above, the actuator can be part of the actuator. The actuator can move the regulating element according to the signal from the regulator or control device. The actuator can be the last connection part in the automatic control chain, which can generally be composed of the following blocks:

[0061] Amplifying devices (contactors, inverters, amplifiers, etc.);

[0062] Actuators (electric, pneumatic or hydraulic) with feedback elements (output shaft position sensor, end position signaling, manual drive, etc.);

[0063] ·Regulating elements (valves, gates, dampers, air doors, etc.).

[0064] Depending on the application conditions, the actuator can have different designs. The main blocks of the actuator usually include the actuator and the regulating element.

[0065] On the one hand, the actuator as a whole can be referred to as an actuator.

[0066] Figure 2 An exemplary embodiment of a system (hereinafter referred to as an inventory system) for identifying computer network devices using inventory rules 214 is shown. In the example shown, the inventory system 210 can be a component of a cyber-physical system (CPS) 200. In one aspect, the inventory system 210 can be configured to passively analyze the intercepted data traffic to collect and accumulate information about various devices of the corresponding computer network (in the example given, the computer network of the CPS 200). In one aspect, the network filter 211 of the inventory system 210 can be configured to intercept the data traffic. The network filter 211 can be configured to intercept each data packet exchanged between the PLC 110b' and the SCADA 110b' components and can be configured to send the intercepted data packets to the rule verification module 212 for verification. In one aspect, the intercepted data traffic can include network packets, which include network, transport and application layer data. In one aspect, the network filter 211 can be configured to intercept data traffic across one or more communication link layers (e.g., according to the transport layer, network layer or data link layer of the OSI model) of a computer network for a range of IP addresses. Each data packet includes a header part and a payload part.

[0067] In one aspect, the rule verification module 212 can be configured to analyze multiple inventory rules to determine whether the intercepted data traffic satisfies any inventory rule 214. In one aspect, multiple inventory rules can be stored, for example, in a database of inventory rules 214. Each of the multiple inventory rules can include a condition indicating the presence of a specific computer network device with a set of specific parameters / attributes. In other words, each inventory rule can include some conditions that, if met, indicate that a network device with given parameters exists in the computer network of CPS200. In one aspect, each inventory rule can have a weighting factor value associated therewith. The weighting factor value can depend on the previously identified computer network device. In one aspect, the weighting factor value of each inventory rule determines the priority of applying the rule.

[0068] In one aspect, the network device identification module 213 can be configured to use the satisfied inventory rules to identify one or more devices of the computer network and parameters associated with the identified devices. In one aspect, during the identification process, the network device identification module 213 can be configured to consider a weighted factor value for each satisfied inventory rule. In one aspect, the network device identification module 213 can be configured to store data about the identified devices in a dedicated database, such as a database containing the device list 215.

[0069] On the one hand, the rule verification module 212 can be configured to search for values ​​that match corresponding parameter values ​​contained in multiple inventory rules in the header portion and / or payload portion of multiple intercepted data packets. Optionally, the rule verification module 212 may include a payload data checker to implement one or more (payload) data inspection techniques; or one or more deep packet inspection (DPI) techniques may be utilized separately. DPI techniques are well known in the art and will not be described in detail for the sake of brevity. On the one hand, if the rule verification module 212 determines that one or more inventory rules are satisfied, the network device identification module 213 may use the satisfied inventory rules to identify one or more devices of the computer network and parameters associated with the identified devices. Such device parameters may include, but are not limited to:

[0070] a) device identifier;

[0071] b) Equipment name;

[0072] c) Equipment model;

[0073] d) Equipment type;

[0074] e) safety status;

[0075] f) manufacturer;

[0076] g) Agreement;

[0077] h) Characteristics of the installed operating system (OS);

[0078] i) Characteristics of installed software.

[0079] The device identifier parameter may be used to provide a clear device identification. The device identifier parameter may, for example, include a MAC address of the device, an IP address of the device, or a combination of these addresses. In various aspects, any other unique device identifier can be used as the device identifier parameter.

[0080] The network device identification module 213 may be configured to determine the device name parameters, for example, using NetBIOS Name Service (NBNS), Domain Name Resolution (DNS), and / or other protocols.

[0081] The device type parameter can include one of the following: HMI / SCADA, relay protection, server, workstation, PLC, engineering station, mobile device, or any other network device.

[0082] The security status parameter may be an indicator of the presence or absence of a critical major security event. The security status may take one of the following example values:

[0083] Critical value - Indicates that at least one critical event involving the device was detected. For example, if an unfixed vulnerability is known about the corresponding device, the security status may contain a critical value.

[0084] Warning value - indicates that there is at least one event involving the device that is likely to affect the security of the device, but the impact on the device may not be critical. For example, the security status can contain a warning value that indicates that the latest version of the operating system or firmware may not be installed on the device, but no critical vulnerabilities have been detected on the device.

[0085] Safe value - Indicates that there are no critical warning security events.

[0086] As described above, the database of inventory rules 214 may include multiple inventory rules. In another aspect, the database of inventory rules 214 may include the following exemplary but non-limiting inventory rules for identifying equipment and corresponding equipment parameters:

[0087] a. Vendor rules, which utilize lists of MAC addresses and / or IP addresses of known devices.

[0088] b. Asset rules, which are configured to search for digital signatures that identify one or more devices and one or more parameters associated therewith. The rules can enable the network device identification module 213 to determine specific device parameters, such as but not limited to the device model, the firmware version on the device, software and / or hardware version number, OS version identifier, information about the services provided by the device, and other parameters.

[0089] c. Protocol rules, which can be configured to search for digital signatures to identify one or more network protocols being used by the intercepted data traffic. This protocol rule can be a special case of an asset rule, which can be used to identify a network protocol.

[0090] d. A fingerprint rule configured to use a digital fingerprint to determine one or more device parameters. In one aspect, the fingerprint rule can utilize multiple generated TCP / IP fingerprints. As used herein, the term "generating a fingerprint" refers to a process of defining a fingerprint based on a rule, particularly using IP scan results and service scan results to generate a network device fingerprint. That is, the IP scan results can be used to generate an operating system (OS) fingerprint based on a transmission control protocol (TCP) / IP packet, and the service scan results can be used to generate a service fingerprint based on a service banner. As used herein, the term "service scan" refers to a scan port corresponding to an IP address determined to be active based on the IP scan results. That is, a service scan involves determining whether a port of a specific IP address is currently providing a service. There is no particular limit to the number of ports to be service scanned. In one aspect, the fingerprint rule can enable the network device to identify module 213 to determine device parameters such as device model and operating system.

[0091] On the one hand, if a device parameter has been identified by at least two different inventory rules, the inventory rule with the largest weighting factor value is selected for device identification. For example, the weighting factor value of the asset rule may be equal to 90, which may be greater than the weighting factor value of the vendor rule (e.g., 20). Accordingly, if the network device identification module 213 uses vendor rules and asset rules to identify devices and device parameters, the asset rule (with the largest weighting factor value) may obtain priority for device identification. In one instance, this situation may be caused by the accuracy of the vendor rule being lower than the accuracy of the asset rule. For example, in a network with multiple routers, a MAC address or IP address may not identify the device itself, but rather identify the router that connects the subject device to the network. In contrast, an asset rule may allow identification of the device itself and corresponding device parameters, such as the device manufacturer.

[0092] On the one hand, if a device parameter has been identified by at least three different inventory rules, such that at least two different inventory rules identify the same value for the device, the network device identification module 213 may add up the values. For example, if inventory rule A (whose weighting factor value is 30) and inventory rule B (whose weighting factor value is 40) have determined that the device's OS is Windows 10, and inventory rule C (whose weighting factor value is 50) has determined that the device's OS is Windows 7, the network device identification module 213 may use inventory rules A and B because their combined weighting factor value (70) is higher than the weighting factor value (50) of rule C. Therefore, in the given example, the network device identification module 213 may determine that the device's OS is Windows 10.

[0093] In another aspect, different network traffic data belonging to the same device can be used to satisfy at least two of the above inventory rules. For example, one rule can be satisfied by analyzing network layer data, while another rule can use transport layer data.

[0094] As described above, in one aspect, the weighting factor value of each inventory rule can depend on previously identified computer network devices and the parameters of those devices. For example, if a particular rule has been used to identify a particular device with particular parameters, and an analyst has confirmed the correctness of the device identification, the weight of the particular rule can be increased accordingly.

[0095] In another aspect, the weighting factor value may depend on the topology of the computer network. For example, if the topology of the computer network is a bus, i.e., there are no routers in the network, then the asset rule and the seller rule may be assigned the same weighting factor value, or the seller rule may be assigned a larger weighting factor value than the asset rule. In the second case, the weighting factor value may be increased. Figure 2The system shown operates faster because the asset rules are not verified again when the seller rules are met.

[0096] On the one hand, in the case of changing the inventory rules or adding new inventory rules, the rule verification module 212 can be configured to verify the changed inventory rules or the corresponding new inventory rules by analyzing the same network services that satisfy the changed inventory rules. Therefore, the system and method for identifying computer system devices using inventory rules proposed by the present invention can immediately identify new devices and their parameters of the computer network after adding new inventory rules or changing existing inventory rules.

[0097] On the other hand, the rule verification module 212 can be configured to verify the satisfaction of the inventory rules in descending order of the weighted factor values ​​of the various inventory rules. On the other hand, when a certain inventory rule is met for the first time, the rule verification module 212 can stop further analyzing the intercepted network business and can stop further verifying the inventory rules. Once at least one inventory rule is met, the network device identification module can be configured to identify at least one device of the computer network and the parameters of the device based on the satisfied inventory rules and taking into account the weighted factor values ​​associated with the rules. Therefore, first, the rule verification module 212 can check the highest priority rule (with the largest weighted factor value) and can even not check the low priority rule (with the lowest weighted factor value). Advantageously, this feature can improve system efficiency.

[0098] On the one hand, after satisfying at least one inventory rule, if the combined weighted factor value of all those satisfied inventory rules is greater than a predetermined threshold, the network device identification module 213 can identify at least one device of the computer network and the parameters of the device according to each satisfied inventory rule. Therefore, if the combined weighted factor value of the satisfied rules is less than the predetermined threshold, the network device identification module 213 may not identify the computer network device at all. This function can reduce the number of first-class errors when low-priority rules incorrectly identify computer network devices or their parameters. Therefore, the accuracy of identifying computer network device parameters can be improved.

[0099] In one aspect, the network device identification module 213 may specify the threshold using one of the following methods:

[0100] a) Separate thresholds for each inventory rule;

[0101] b) the joint threshold of all inventory rules;

[0102] c) A joint threshold of a set of rules, wherein the set of rules includes at least two inventory rules that identify the same computer network device or parameters of the same computer network device.

[0103] In one aspect, network filter 211 can be configured to intercept only network traffic from new devices that have not been previously identified.Data regarding previously identified devices can be placed by network device identification module 213 on, for example, device list database 215.

[0104] On the one hand, inventory rules can be written in a formal language, an example of which is YAML. An example of a seller rule is as follows:

[0105] id:4

[0106] confidence:20

[0107] vendor_mac_list:['00:13:d5','94:b8:c5','00:0a:dc']

[0108] host:{vendor:HostVendor_Rugged,key:src_mac}

[0109] This rule identifies a device whose manufacturer (Host field) is HostVendor_Rugged, provided that the MAC address of the device is contained in the list vendor_mac_list. The device will be assigned an identifier id=4 and a weighting factor value (confidence value)=20.

[0110] Examples of asset rules are as follows:

[0111] id:13009

[0112] confidence:90

[0113] message:"Siemens Siprotec Model"

[0114] protocols:[goose]

[0115] prefilter:{pattern:"^.{8}\\x61.+7(SD|SA|UT|SJ|VK|VE)(4|5|6|8)\\d\\d?",flags:"Hsi"}

[0116] host:{type:HostType_Plc,vendor:HostVendor_Siemens,key:src_mac}

[0117] asset:

[0118] type:hardware,

[0119] key:AssetKey_Model,

[0120] pattern:"(7[A-Za-z][A-Za-z]\\d\\d\\d?)",

[0121] #ParamLoc_PlcModel_Siprotec_Param1='SIPROTEC'+$p0

[0122] param_loc:ParamLoc_PlcModel_Siprotec_Param1}

[0123] This rule can be used for data of protocol GOOSE (protocol field), and the pre-filter field will contain templates for searching matches for the rule conditions in the network data layer. The network device described by the host field is the source of the network traffic that satisfies the rule (the device can be a router or device that needs to be identified). In the given example, the device type is PLC, the manufacturer (seller) is Siemens, and the device address (key) is the MAC address of the device. The asset field specifies the device and the device parameters that will be identified by the rule. The asset field can contain some values, such as type (the type of information extracted from the network traffic; in the given example, information about the hardware) and mode (a template for extracting necessary information from the network traffic after performing pre-filtering on the rule). The value of param_loc can contain the result of extracting information from the network traffic.

[0124] Examples of protocol rules are as follows:

[0125] id:200006

[0126] confidence:75

[0127] message:"RDP Protocol"

[0128] protocols:[tcp]prefilter:{pattern:"rdpdr.*cliprdr.*rdpsnd",flags:"Hsi"}

[0129] asset:{type:software,key:AssetKey_CommonProto,description:CommonProto_Rdp_OverTcp}

[0130] In this example, the protocol rule utilizes TCP layer data with an indication pre-filter, which, when satisfied, identifies the protocol RDP (Remote Desktop Protocol).

[0131] Examples of fingerprint rules are as follows:

[0132] id:15000005

[0133] confidence:50

[0134] message:"General Electric C60 / B30(SYN+ACK)"

[0135] ip_flags:[]ttl:[[27,30]]

[0136] tcp_flags:[syn,ack]

[0137] tcp_win_size:[

[4096] ]

[0138] tcp_options:[mss]

[0139] eth_padding: "(ether[padding_offset:2]==0x8888)"

[0140] host:{type:HostType_Plc,vendor:HostVendor_GE,key:src_ip}asset:{type:hardware,key:AssetKey_Model,description:PlcModel_GeneralElectric_C60_B30}

[0141] The conditions for satisfying this rule may be that the ttl protocol parameter ranges from 27 to 30, the flags syn and ack are present, the TCP protocol window size (tcp_win_size) is equal to 4096, and the transport layer option mss (maximum segment size) is present. In addition, the analyzed network service data should satisfy the BPF filter eth_padding.

[0142] Figure 3 A flow chart of a method for identifying computer network devices using inventory rules according to aspects of the present disclosure is shown. At step 301, network filter 211 can intercept network traffic. Network filter 211 can be configured to intercept each data packet exchanged between PLC 110b' and SCADA 110b' components and can be configured to send the intercepted data packets to rule validation module 212 for validation. In one aspect, the intercepted data traffic can include network packets, which include network, transport, and application layer data. Each data packet includes a header portion and a payload portion.

[0143] Next, in step 302, rule verification module 212 can analyze the intercepted network business to determine whether the intercepted data business meets any inventory rules. On the one hand, multiple inventory rules can be, for example, stored in a database of inventory rules 214. Each of multiple inventory rules can include a condition indicating the presence of a specific computer network device with a set of specific parameters / attributes. In other words, each inventory rule can contain some conditions, and if these conditions are met, it indicates that there is a network device with given parameters in the computer network of CPS200. On the one hand, each inventory rule can have a weighted factor value associated with it. The weighted factor value can depend on the computer network device previously identified. On the one hand, the weighted factor value of each inventory rule determines the priority of applying the rule.

[0144] In response to satisfying one or more inventory rules, at step 303, the network device identification module 213 can use the satisfied inventory rules to identify one or more devices of the computer network and parameters associated with the identified devices. In one aspect, during the identification process, the network device identification module 213 can consider the weighted factor value of each satisfied inventory rule. In one aspect, the network device identification module 213 can store data about the identified devices in a database containing a device list 215. Figure 2 The specific exemplary aspects of the system described in also apply to the present method.

[0145] Therefore, the system and method proposed in the present invention can solve the technical problem of low level of identification of network device parameters and provide the technical effect of the present invention, namely, improving the accuracy of identifying and / or determining network device parameters using inventory rules and considering corresponding weighting factor values.

[0146] Figure 4 is a block diagram illustrating a computer system 20 on which aspects of a system and method for detecting malicious files may be implemented according to an exemplary aspect. The computer system 20 may represent Figure 2 The inventory system 210 in can take the form of multiple computing devices or the form of a single computing device, such as desktop computers, notebook computers, laptop computers, mobile computing devices, smart phones, tablet computers, servers, mainframes, embedded devices, and other forms of computing devices.

[0147] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 that connects various system components, including memory associated with central processing unit 21. System bus 23 may include a bus memory or bus memory controller, a peripheral bus, and a local bus that can interact with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, etc. TM 、InfiniBand TM , SerialATA, I2C and other appropriate interconnects. The central processing unit 21 (also referred to as a processor) can include a single group or multiple groups of processors with a single core or multiple cores. The processor 21 can execute one or more computer executable codes that implement the disclosed technology. The system memory 22 can be any memory for storing data used herein and / or computer programs that can be executed by the processor 21. The system memory 22 can include volatile memory such as a random access memory (RAM) 25 and non-volatile memory such as a read-only memory (ROM) 24, flash memory, etc. or any combination thereof. The basic input / output system (BIOS) 26 can store basic processes for transferring information between elements of the computer system 20, such as those basic processes when the operating system is loaded using the ROM 24.

[0148] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the non-removable storage devices 28 are connected to the system bus 23 via a storage interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as a solid-state drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage devices, such as hard drives or floppy disks; optical storage devices, such as compact disks (CD-ROMs) or digital versatile disks (DVDs); and any other medium that can be used to store the desired data and that can be accessed by the computer system 20.

[0149] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional program applications 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for communicating data from input device 40 (such as a keyboard, mouse, stylus, game controller, voice input device, touch input device) or other peripheral devices (such as printers or scanners) via one or more I / O ports (such as serial ports, parallel ports, universal serial bus (USB) or other peripheral interfaces). Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 across output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 can also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0150] The computer system 20 can operate in a network environment using a network connection to one or more remote computers 49. The remote computer (or multiple remote computers) 49 can be a local computer workstation or server, including most or all of the elements described above when describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, network stations, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating via one or more networks, such as a local area computer network (LAN) 50, a wide area computer network (WAN), an intranet, and the Internet. Examples of network interfaces 51 may include Ethernet interfaces, frame relay interfaces, SONET interfaces, and wireless interfaces.

[0151] Aspects of the present disclosure may be systems, methods and / or computer program products. The computer program product may include a computer-readable storage medium (media) on which computer-readable program instructions are used to cause a processor to perform aspects of the present disclosure.

[0152] Computer readable storage medium can be a tangible device that can retain and save program code in the form of instructions or data structures, and the program code can be accessed by a processor of a computing device (such as computing system 20). Computer readable storage medium can be an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. For example, such computer readable storage medium can include random access memory (RAM), read-only memory (ROM), EEPROM, portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), flash memory, hard disk, portable computer floppy disk, memory stick, floppy disk, or even mechanical encoding device, such as a punch card or concave-convex structure recording instructions above. As used herein, computer readable storage medium should not be interpreted as being a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagated by waveguides or transmission media, or electrical signals transmitted by wires.

[0153] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing device or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include transmission copper cables, transmission optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in each computing device.

[0154] The computer-readable program instructions for performing the operation described in the present disclosure can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages) and conventional process-oriented programming languages. The computer-readable program instructions can be performed completely on the user's computer, partly on the user's computer, performed as an independent software package, partly on the user's computer and partly on a remote computer or performed completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected (for example, through the Internet) with an external computer. In certain embodiments, electronic circuits (for example, including programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (PLA)) can be performed by utilizing the state information of computer-readable program instructions to perform computer-readable program instructions and personalized electronic circuits to perform various aspects of the present disclosure.

[0155] In various aspects, the system and method described in the present disclosure can be solved according to modules. As used herein, the term "module" refers to a device, component or component arrangement of the real world implemented using hardware (such as by an application-specific integrated circuit (ASIC) or FPGA) or as a combination of hardware and software, such as a microprocessor system and a set of instructions to implement module functions, which convert the microprocessor system into a special-purpose device when executed. Modules can also be implemented as a combination of the two, in which some functions are promoted only by hardware, while other functions are promoted by a combination of hardware and software. In some embodiments, at least a portion of the modules (all modules in some cases) can be executed on a processor of a computer system. Accordingly, each module can be implemented with various appropriate configurations, and should not be limited to any specific embodiment illustrated herein.

[0156] For the sake of clarity, not all conventional features of various aspects are disclosed herein. It should be appreciated that in the development of any actual implementation of the present disclosure, a large number of specific implementation decisions must be made in order to achieve the specific goals of the developers, and these specific goals will vary from one implementation to another and from one developer to another. It should be understood that such development work may be complex and time consuming, but is still a routine engineering task for those of ordinary skill in the art who benefit from the present disclosure.

[0157] It should also be understood that the words or terms used herein are for description rather than limitation purposes, and those skilled in the art will interpret the terms or terms of this specification in accordance with the teachings and guidance provided herein combined with the knowledge of those skilled in the relevant art. Moreover, any term in the specification or claims is not intended to be given a rare or special meaning unless otherwise expressly stated.

[0158] The various aspects disclosed herein encompass the current and future known equivalents of the known modules illustrated herein. Moreover, although multiple aspects and applications have been illustrated and described, it will be apparent to those skilled in the art having benefited from this disclosure that more modifications may be made than those described above without departing from the inventive concepts disclosed herein.

Claims

1. A method for identifying a computer network device using inventory rules, the method comprising: intercepting data traffic across one or more communication links of a computer network; analyzing the intercepted data traffic to determine whether the intercepted data traffic satisfies one or more inventory rules of a plurality of inventory rules, wherein each of the plurality of inventory rules includes one or more conditions indicating the presence of a particular computer network device having a set of parameters; and identifying one or more devices of the computer network using one or more satisfied inventory rules, The multiple inventory rules include at least one of the following: i) a vendor rule listing one or more network addresses associated with each of the one or more devices; ii) an asset rule configured to search for a digital signature identifying one or more devices and one or more parameters associated therewith; iii) protocol rules configured to search the digital signature to identify one or more network protocols being used by the intercepted data traffic; and iv) Fingerprint rules configured to use a digital fingerprint to determine one or more device parameters.

2. The method according to claim 1, wherein: Each of the plurality of inventory rules has a weighting factor value indicating a priority for applying the corresponding rule.

3. The method according to claim 2, wherein: The weighting factor value depends on the previously identified device.

4. The method according to claim 3, wherein: Analyzing the plurality of inventory rules to determine whether one or more of the plurality of inventory rules are satisfied further includes searching at least one of header portions and payload portions of a plurality of data packets for a value that matches a corresponding parameter value contained in the plurality of inventory rules.

5. The method according to claim 1, wherein: The set of parameters includes at least one of the following: a device identifier, a device name, a device model, a device type, a device security status, a device manufacturer, a protocol, one or more characteristics of an operating system installed on the corresponding device, and one or more characteristics of a software program installed on the corresponding device.

6. The method according to claim 2, wherein: If a device parameter has been identified by at least two different inventory rules, the inventory rule with the largest weighting factor value is selected for device identification.

7. A system for identifying computer network devices using inventory rules, the system comprising: Hardware processor, which is configured as: intercepting data traffic across one or more communication links of a computer network; analyzing the intercepted data traffic to determine whether the intercepted data traffic satisfies one or more inventory rules of a plurality of inventory rules, wherein each of the plurality of inventory rules includes one or more conditions indicating the presence of a particular computer network device having a set of parameters; and identifying one or more devices of the computer network using one or more satisfied inventory rules, The multiple inventory rules include at least one of the following: i) a vendor rule listing one or more network addresses associated with each of the one or more devices; ii) an asset rule configured to search for a digital signature identifying one or more devices and one or more parameters associated therewith; iii) protocol rules configured to search the digital signature to identify one or more network protocols being used by the intercepted data traffic; and iv) Fingerprint rules configured to use a digital fingerprint to determine one or more device parameters.

8. The system according to claim 7, wherein: Each of the plurality of inventory rules has a weighting factor value indicating a priority for applying the corresponding rule.

9. The system according to claim 8, wherein: The weighting factor value depends on the previously identified device.

10. The system according to claim 9, wherein: The hardware processor configured to analyze the plurality of inventory rules to determine whether one or more of the plurality of inventory rules are satisfied is further configured to search at least one of a header portion and a payload portion of a plurality of data packets for a value that matches a corresponding parameter value contained in the plurality of inventory rules.

11. The system according to claim 7, wherein: The set of parameters includes at least one of the following: a device identifier, a device name, a device model, a device type, a device security status, a device manufacturer, a protocol, one or more characteristics of an operating system installed on the corresponding device, and one or more characteristics of a software program installed on the corresponding device.

12. The system according to claim 8, wherein: If a device parameter has been identified by at least two different inventory rules, the inventory rule with the largest weighting factor value is selected for device identification.

13. A non-transitory computer-readable medium having stored thereon computer-executable instructions for identifying computer network devices using inventory rules, the instructions causing a computer to: intercepting data traffic across one or more communication links of a computer network; Analyzing the intercepted data traffic to determine whether the intercepted data traffic satisfies one or more inventory rules of a plurality of inventory rules, wherein: Each of the plurality of inventory rules includes one or more conditions indicating the presence of a particular computer network device having a set of parameters; as well as identifying one or more devices of the computer network using one or more satisfied inventory rules, The multiple inventory rules include at least one of the following: i) a vendor rule listing one or more network addresses associated with each of the one or more devices; ii) an asset rule configured to search for a digital signature identifying one or more devices and one or more parameters associated therewith; iii) protocol rules configured to search the digital signature to identify one or more network protocols being used by the intercepted data traffic; and iv) Fingerprint rules configured to use a digital fingerprint to determine one or more device parameters.

14. The non-transitory computer readable medium of claim 13, wherein: Each of the plurality of inventory rules has a weighting factor value indicating a priority for applying the corresponding rule.

15. The non-transitory computer readable medium of claim 14, wherein: The weighting factor value depends on the previously identified device.

16. The non-transitory computer readable medium of claim 15, wherein: Analyzing the plurality of inventory rules to determine whether one or more of the plurality of inventory rules are satisfied further includes searching at least one of header portions and payload portions of a plurality of data packets for a value that matches a corresponding parameter value contained in the plurality of inventory rules.

17. The non-transitory computer readable medium of claim 13, wherein: The set of parameters includes at least one of the following: a device identifier, a device name, a device model, a device type, a device security status, a device manufacturer, a protocol, one or more characteristics of an operating system installed on the corresponding device, and one or more characteristics of a software program installed on the corresponding device.

Images